Question 1

An external contractor, who has not been given information about the software or network architecture, is conducting a penetration test. Which of the following BEST describes the test being performed?

Accepted Answer

Black box testing is performed by an external contractor who has not been given information about the software or network architecture.

Question 2

A security administrator wants to implement a logon script that will prevent MITM attacks on the local LAN. Which of the following commands should the security administrator implement within the script to accomplish this task?

Accepted Answer

The command "arp -s" is used to set a static ARP entry, which can help prevent ARP spoofing, a common type of MITM attack on local networks.

Question 3

Which of the following could help detect trespassers in a secure facility? (Select TWO)

Accepted Answer

Motion-detection sensors and security guards can both help detect trespassers in a secure facility. Motion-detection sensors can detect movement, while security guards can patrol the facility and look for suspicious activity.

Question 4

A web developer improves client access to the company's REST API. Authentication needs to be tokenized but not expose the client's password. Which of the following methods would BEST meet the developer's requirements?

Accepted Answer

The answer of A web developer improves client access to...

Question 5

A datacenter recently experienced a breach. When access was gained, an RF device was used to access an air-gapped and locked server rack. Which of the following would BEST prevent this type of attack?

Accepted Answer

A Faraday cage would best prevent this type of attack by blocking RF signals from reaching the air-gapped and locked server rack, thus preventing unauthorized access via RF devices.

Question 6

A small company's Chief Executive Officer (CEO) has asked its Chief Security Officer (CSO) to improve the company's security posture quickly with regard to targeted attacks. Which of the following should the CSO conduct FIRST?

Accepted Answer

Understanding the specific threats faced by similar companies in the same industry can provide valuable insights into potential vulnerabilities and attack vectors, allowing the CSO to prioritize and address the most relevant security concerns quickly.

Question 7

Which of the following delineates why it is important to perform egress filtering and monitoring on Internet connected security zones of interfaces on a firewall?

Accepted Answer

Egress filtering and monitoring help identify and block outbound traffic that may be communicating with known botnet sources, preventing compromised systems within the network from participating in malicious activities.

Question 8

Security administrators attempted corrective action after a phishing attack. Users are still experiencing trouble logging in, as well as an increase in account lockouts. Users' email contacts are complaining of an increase in spam and social networking requests. Due to the large number of affected accounts, remediation must be accomplished quickly. Which of the following actions should be taken FIRST? (Select TWO)

Accepted Answer

Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators. n a Small Business Server environment, you may have to prevent your Microsoft Exchange Server-based server from being used as an open relay SMTP server for unsolicited commercial e-mail messages, or spam. You may also have to clean up the Exchange server's SMTP queues to delete the unsolicited commercial e- mail messages. If your Exchange server is being used as an open SMTP relay, you may experience one or more of the following symptoms: The Exchange server cannot deliver outbound SMTP mail to a growing list of e-mail domains. Internet browsing is slow from the server and from local area network (LAN) clients. Free disk space on the Exchange server in the location of the Exchange information store databases or the Exchange information store transaction logs is reduced more rapidly than you expect. The Microsoft Exchange information store databases spontaneously dismount. You may be able to manually mount the stores by using Exchange System Manager, but the stores may dismount on their own after they run for a short time. For more information, click the following article number to view the article in the Microsoft Knowledge Base.

Question 9

Which of the following could occur when both strong and weak ciphers are configured on a VPN concentrator? (Select TWO)

Accepted Answer

The answer of Which of the following could occur when...

Question 10

The POODLE attack is an MITM exploit that affects:

Accepted Answer

A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. How To Protect your Server Against the POODLE SSLv3 Vulnerability On October 14th, 2014, a vulnerability in version 3 of the SSL encryption protocol was disclosed. This vulnerability, dubbed POODLE (Padding Oracle On Downgraded Legacy Encryption), allows an attacker to read information encrypted with this version of the protocol in plain text using a man-in-the-middle attack. Although SSLv3 is an older version of the protocol which is mainly obsolete, many pieces of software still fall back on SSLv3 if better encryption options are not available. More importantly, it is possible for an attacker to force SSLv3 connections if it is an available alternative for both participants attempting a connection. The POODLE vulnerability affects any services or clients that make it possible to communicate using SSLv3. Because this is a flaw with the protocol design, and not an implementation issue, every piece of software that uses SSLv3 is vulnerable. To find out more information about the vulnerability, consult the CVE information found at CVE-2014-3566. What is the POODLE Vulnerability? The POODLE vulnerability is a weakness in version 3 of the SSL protocol that allows an attacker in a man-in- the-middle context to decipher the plain text content of an SSLv3 encrypted message. Who is Affected by this Vulnerability? This vulnerability affects every piece of software that can be coerced into communicating with SSLv3. This means that any software that implements a fallback mechanism that includes SSLv3 support is vulnerable and can be exploited. Some common pieces of software that may be affected are web browsers, web servers, VPN servers, mail servers, etc. How Does It Work? In short, the POODLE vulnerability exists because the SSLv3 protocol does not adequately check the padding bytes that are sent with encrypted messages. Since these cannot be verified by the receiving party, an attacker can replace these and pass them on to the intended destination. When done in a specific way, the modified payload will potentially be accepted by the recipient without complaint. An average of once out of every 256 requests will accepted at the destination, allowing the attacker to decrypt a single byte. This can be repeated easily in order to progressively decrypt additional bytes. Any attacker able to repeatedly force a participant to resend data using this protocol can break the encryption in a very short amount of time. How Can I Protect Myself? Actions should be taken to ensure that you are not vulnerable in your roles as both a client and a server. Since encryption is usually negotiated between clients and servers, it is an issue that involves both parties. Servers and clients should should take steps to disable SSLv3 support completely. Many applications use better encryption by default, but implement SSLv3 support as a fallback option. This should be disabled, as a malicious user can force SSLv3 communication if both participants allow it as an acceptable method.

Question 11

Which of the following techniques can be bypass a user or computer's web browser privacy settings? (Select Two)

Accepted Answer

The answer of Which of the following techniques can be...

Question 12

A security analyst is updating a BIA document. The security analyst notices the support vendor's time to replace a server hard drive went from eight hours to two hours. Given these new metrics, which of the following can be concluded? (Select TWO)

Accepted Answer

The MTTR (Mean Time To Repair) has decreased because the time to replace a server hard drive has decreased from eight hours to two hours. The RTO (Recovery Time Objective) has also decreased because the time to recover from a server hard drive failure has decreased.

Question 13

A user needs to send sensitive information to a colleague using PKI. Which of the following concepts apply when a sender encrypts the message hash with the sender's private key? (Select TWO)

Accepted Answer

Encrypting the message hash with the sender's private key provides non-repudiation, as it verifies the sender's identity. It also ensures message integrity, as the recipient can verify that the message has not been altered.

Question 14

Which of the following strategies should a systems architect use to minimize availability risks due to insufficient storage capacity?

Accepted Answer

Scalability allows a system to handle increased loads by adding resources, thus minimizing risks related to insufficient storage capacity.

Question 15

After a security incident, management is meeting with involved employees to document the incident and its aftermath. Which of the following BEST describes this phase of the incident response process?

Accepted Answer

This phase is known as "Lessons learned," where the incident is reviewed to understand what happened, what was done well, and what could be improved for future incidents.

Question 16

Ann, a security administrator, wants to ensure credentials are encrypted in transit when implementing a RADIUS server for SSO. Which of the following are needed given these requirements? (Select TWO)

Accepted Answer

The answer of Ann, a security administrator, wants to ensure...

Question 17

To determine the ALE of a particular risk, which of the following must be calculated? (Select two.)

Accepted Answer

The answer of To determine the ALE of a particular...

Question 18

Which of the following are used to increase the computing time it takes to brute force a password using an offline attack? (Select TWO)

Accepted Answer

PBKDF2 and bcrypt are both key derivation functions that are used to slow down brute force attacks. They do this by making it more difficult to guess the password, even if the attacker has access to the hashed password.

Question 19

A web server, which is configured to use TLS with AES-GCM-256, SHA-384, and ECDSA, recently suffered an information loss breach. Which of the following is MOST likely the cause?

Accepted Answer

Poor implementation is the most likely cause of the breach, as the components mentioned (AES-GCM-256, SHA-384, ECDSA) are strong and secure when properly implemented.

Question 20

A security administrator needs to address the following audit recommendations for a public-facing SFTP server: Users should be restricted to upload and download files to their own home directories only. Users should not be allowed to use interactive shell login. Which of the following configuration parameters should be implemented? (Select TWO).

Accepted Answer

ChrootDirectory restricts users to their own home directories, and PermitTTY set to "no" prevents interactive shell logins.

Exam 15: CompTIA Security+